CompTIA CS0-003 Practice Test 34
Question 330
At Industrial firmware producer, the incident team supports signed build pipeline. A new security event is reported: a vendor installer update is replaced with a malicious unsigned package on distribution mirror. The log clue is: package checksums differ from signed release manifest and build logs show unexplained mirror upload. The incident has been contained and normal service has resumed. A post-incident review identifies that unmonitored mirror upload permission lacked release signature enforcement. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness unmonitored mirror upload permission lacked release signature enforcement
- Assign an owner and measurable corrective action addressing the root cause: unmonitored mirror upload permission lacked release signature enforcement, with a future effectiveness test
- Close the follow-up for signed build pipeline merely because restoration completed, without addressing unmonitored mirror upload permission lacked release signature enforcement
- Write a lessons-learned memo about a vendor installer update is replaced with a malicious unsigned package on distribution mirror with no due date, control owner or validation activity
Explanation
Correct Answer
B:Unmonitored mirror upload permission lacked release signature enforcement was the systemic weakness that enabled or worsened a vendor installer update is replaced with a malicious unsigned package on distribution mirror. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: unmonitored mirror upload permission lacked release signature enforcement.
C:Service restoration does not address unmonitored mirror upload permission lacked release signature enforcement; ignoring it leaves the next incident likely to follow the same route.
D:An unowned recommendation does not produce a verified control improvement for signed build pipeline.
Question 331
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. What information should be delivered first to decision makers responsible for notification must balance urgency, accuracy and legal duties?
- Forward raw telemetry from access logs, affected data types and relevant regulatory deadlines to executives without summarizing consequences for notification must balance urgency, accuracy and legal duties
- State that evidence suggests a possible reportable privacy event was eliminated because Regional credit union distributed a dashboard on schedule
- Present a concise, evidence-qualified risk and impact summary based on access logs, affected data types and relevant regulatory deadlines, with decisions and uncertainty stated
- Report only the number of tickets closed for customer identity breach, concealing the unresolved exposure from evidence suggests a possible reportable privacy event
Explanation
Correct Answer
C:Access logs, affected data types and relevant regulatory deadlines supports a decision-oriented picture of notification must balance urgency, accuracy and legal duties while separating confirmed facts from unknowns. This corrects the reporting defect: executive asks PR to issue notification before counsel determines threshold.
Incorrect Answers
A:Raw telemetry may support analysts, but decision makers need the meaning for notification must balance urgency, accuracy and legal duties and accountable options.
B:Reporting timeliness is not evidence that access logs, affected data types and relevant regulatory deadlines shows full risk elimination.
D:Ticket counts do not establish whether evidence suggests a possible reportable privacy event still threatens notification must balance urgency, accuracy and legal duties.
Question 332
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Remove the timestamps and correlations from access logs, affected data types and relevant regulatory deadlines so the technical report occupies fewer pages
- Give privacy response lead the same board overview rather than the reproducible records from access logs, affected data types and relevant regulatory deadlines
- Accept an assertion that privacy response lead completed the correction with no retest against access logs, affected data types and relevant regulatory deadlines
- Provide the original relevant artifacts and validation method from access logs, affected data types and relevant regulatory deadlines, tied to affected assets, owners and retest criteria
Explanation
Correct Answer
D:Access logs, affected data types and relevant regulatory deadlines gives engineers traceable scope and a basis for confirming that privacy response lead has resolved the identified exposure on customer identity breach.
Incorrect Answers
A:Such edits break reproducibility of evidence suggests a possible reportable privacy event and make scope or remediation errors harder to find.
B:A high-level board summary cannot identify the concrete access logs, affected data types and relevant regulatory deadlines fields needed for technical validation.
C:Self-assessment without test artifacts is weaker than verifiable access logs, affected data types and relevant regulatory deadlines and agreed acceptance conditions.
Question 333
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. Stakeholders include privacy counsel and executive risk committee. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Withhold notification of evidence suggests a possible reportable privacy event indefinitely even after verified access logs, affected data types and relevant regulatory deadlines meets a binding disclosure threshold
- Coordinate fact-checked messages, recipients and timing with privacy counsel and executive risk committee, preserving applicable legal and incident approval paths
- Release unconfirmed details about evidence suggests a possible reportable privacy event externally before evidence and approvals from privacy counsel and executive risk committee have been reconciled
- Give a technical engineer sole authority for every legal or public statement otherwise owned by privacy counsel and executive risk committee
Explanation
Correct Answer
B:The parties privacy counsel and executive risk committee have different responsibilities. Using verified access logs, affected data types and relevant regulatory deadlines and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:If verified access logs, affected data types and relevant regulatory deadlines triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
C:Unconfirmed claims could misrepresent the impact of evidence suggests a possible reportable privacy event and breach communication obligations.
D:Technical diagnosis does not automatically confer the disclosure authority held by privacy counsel and executive risk committee.
Question 334
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Measure improvement in decision log for notification threshold and provisional facts by how many slides were added to the board presentation
- Redefine decision log for notification threshold and provisional facts every week until all dashboards appear positive
- Compare Regional credit union teams only by tickets closed, ignoring which services are still exposed to evidence suggests a possible reportable privacy event
- Track a defined, evidence-based measure of decision log for notification threshold and provisional facts, with trend, scope and accountable source
Explanation
Correct Answer
D:The measure decision log for notification threshold and provisional facts connects reporting to a change in notification must balance urgency, accuracy and legal duties, rather than the number of reports or raw alert volume. Trends must use consistent inputs from access logs, affected data types and relevant regulatory deadlines.
Incorrect Answers
A:Presentation size does not establish decision log for notification threshold and provisional facts or whether evidence suggests a possible reportable privacy event is managed.
B:Inconsistent measures cannot support a credible trend for decision log for notification threshold and provisional facts.
C:Tickets can hide unresolved notification must balance urgency, accuracy and legal duties; a risk-weighted outcome metric is needed.
Question 335
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. An action plan is being negotiated, but final record count is under review. What reporting recommendation best supports practical remediation?
- Copy a generic checklist for evidence suggests a possible reportable privacy event without accountable owners, asset scope or milestones
- Set an immediate fix deadline for customer identity breach without acknowledging that final record count is under review
- Give privacy response lead an unlimited exception because final record count is under review rather than reporting residual risk and expiry
- Ask the privacy response lead to document mitigation choices for customer identity breach, service constraints, milestones, approvers and time-bound risk acceptance if needed
Explanation
Correct Answer
D:Final record count is under review creates a real implementation constraint. A plan owned by privacy response lead with measured risk and delegated approvals protects notification must balance urgency, accuracy and legal duties better than an unrealistic generic deadline.
Incorrect Answers
A:A non-accountable template cannot address final record count is under review or demonstrate progress on evidence suggests a possible reportable privacy event.
B:Ignoring final record count is under review can turn a security fix into service disruption while failing to clarify remaining risk.
C:Notification must balance urgency, accuracy and legal duties still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
Question 336
Regional credit union is reviewing a security finding affecting customer identity breach: evidence suggests a possible reportable privacy event. The current reporting problem is that executive asks PR to issue notification before counsel determines threshold. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Use the number of remediation meetings at Regional credit union instead of observed change in decision log for notification threshold and provisional facts as closeout proof
- Close evidence suggests a possible reportable privacy event based solely on a self-reported completion email from privacy response lead with no verification
- Report retested access logs, affected data types and relevant regulatory deadlines, the outcome against decision log for notification threshold and provisional facts, remaining exceptions, and owner confirmation
- Discard the pre-change evidence access logs, affected data types and relevant regulatory deadlines so that only the improved numbers for decision log for notification threshold and provisional facts remain
Explanation
Correct Answer
C:Access logs, affected data types and relevant regulatory deadlines provides source-linked closure proof. Showing decision log for notification threshold and provisional facts and residual exceptions verifies whether privacy response lead actually reduced notification must balance urgency, accuracy and legal duties rather than merely marking a ticket closed.
Incorrect Answers
A:Meetings do not confirm that evidence suggests a possible reportable privacy event was corrected or that remaining notification must balance urgency, accuracy and legal duties is acceptable.
B:Self-declared completion does not demonstrate improved decision log for notification threshold and provisional facts against documented access logs, affected data types and relevant regulatory deadlines.
D:Without historical decision log for notification threshold and provisional facts inputs, leaders cannot validate the claimed improvement or identify recurrence.
Question 337
At Healthcare provider, analysts monitor patient scheduling SaaS. They observe that a newly consented OAuth app reads all calendars and mailbox metadata with offline access. Evidence: identity audit records broad OAuth scopes and grant by one non-admin user. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat authorized calendar integrations have restricted scopes and a vetted app registration as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of malicious OAuth consent grant granting persistent data access and begin corroborating it with endpoint and network evidence
- Announce that identity audit records broad OAuth scopes and grant by one non-admin user conclusively proves theft of appointment privacy before reviewing any sessions or file access
- Downgrade a newly consented OAuth app reads all calendars and mailbox metadata with offline access solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
B:The combination of a newly consented OAuth app reads all calendars and mailbox metadata with offline access and identity audit records broad OAuth scopes and grant by one non-admin user is suspicious for malicious OAuth consent grant granting persistent data access. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting appointment privacy.
Incorrect Answers
A:The legitimate comparator is authorized calendar integrations have restricted scopes and a vetted app registration; it does not establish that the current event came from the same approved identity or workflow.
C:identity audit records broad OAuth scopes and grant by one non-admin user is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on patient scheduling SaaS warrants its own validation before expanding or closing the investigation.
Question 338
At Healthcare provider, analysts monitor patient scheduling SaaS. They observe that a newly consented OAuth app reads all calendars and mailbox metadata with offline access. Evidence: identity audit records broad OAuth scopes and grant by one non-admin user. A separate known-good explanation is: authorized calendar integrations have restricted scopes and a vetted app registration. Which next analysis most reliably determines what caused the observed event?
- Suspend telemetry collection on patient scheduling SaaS while waiting for the connection pattern to stop
- Perform a scoped investigation: inspect application consent grant, publisher identity and exact API activity
- Accept a public reputation score for the destination as proof of the origin of identity audit records broad OAuth scopes and grant by one non-admin user, without using inspect application consent grant, publisher identity and exact API activity
- Summarize identity audit records broad OAuth scopes and grant by one non-admin user into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
B:Inspect application consent grant, publisher identity and exact API activity ties the evidence on patient scheduling SaaS to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized calendar integrations have restricted scopes and a vetted app registration.
Incorrect Answers
A:Suppressing telemetry destroys the source needed to investigate malicious OAuth consent grant granting persistent data access and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of identity audit records broad OAuth scopes and grant by one non-admin user or whether the activity matches authorized calendar integrations have restricted scopes and a vetted app registration.
D:The original identity audit records broad OAuth scopes and grant by one non-admin user must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 339
Healthcare provider has a candidate alert for patient scheduling SaaS: identity audit records broad OAuth scopes and grant by one non-admin user. The team argues it is harmless because authorized calendar integrations have restricted scopes and a vetted app registration. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a newly consented OAuth app reads all calendars and mailbox metadata with offline access is benign
- Automatically treat every event resembling identity audit records broad OAuth scopes and grant by one non-admin user as confirmed compromise of patient scheduling SaaS, without checking provenance
- Create a blanket suppression for identity audit records broad OAuth scopes and grant by one non-admin user because authorized calendar integrations have restricted scopes and a vetted app registration can produce a superficially similar event
- Distinguish identity audit records broad OAuth scopes and grant by one non-admin user from the approved behavior (authorized calendar integrations have restricted scopes and a vetted app registration) by validating process, identity and time attribution
Explanation
Correct Answer
D:Authorized calendar integrations have restricted scopes and a vetted app registration is a plausible alternative, but it must be proven to match the actual source of identity audit records broad OAuth scopes and grant by one non-admin user. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a newly consented OAuth app reads all calendars and mailbox metadata with offline access.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting appointment privacy.
C:Similarity to authorized calendar integrations have restricted scopes and a vetted app registration does not exclude an attacker from producing the same surface event on patient scheduling SaaS.
Question 340
At Healthcare provider, analysts monitor patient scheduling SaaS. They observe that a newly consented OAuth app reads all calendars and mailbox metadata with offline access. Evidence: identity audit records broad OAuth scopes and grant by one non-admin user. The team confirms unauthorized behavior and must protect appointment privacy; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: revoke the unapproved app grant and invalidate its tokens while retaining clinical scheduling access
- Erase identity audit records broad OAuth scopes and grant by one non-admin user from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on patient scheduling SaaS unrestricted until actual losses of appointment privacy can be measured
- Disable every production service at Healthcare provider without measuring whether its dependencies share the observed malicious path
Explanation
Correct Answer
A:Revoke the unapproved app grant and invalidate its tokens while retaining clinical scheduling access constrains the observed threat while maintaining necessary service for appointment privacy. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Eliminating identity audit records broad OAuth scopes and grant by one non-admin user evidence does not contain malicious OAuth consent grant granting persistent data access and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on patient scheduling SaaS, delaying containment could expand the exposure affecting appointment privacy.
D:Global shutdown could disrupt appointment privacy without evidence that every system has been affected; scoped isolation is more proportionate.
